MozDef: The Mozilla Defense Platform
Clone or download
Latest commit 4b43aa5 Oct 16, 2018
Permalink
Failed to load latest commit information.
.github Update ISSUE_TEMPLATE.md Jun 15, 2017
alerts Make events work for single or multiple events, this alert will work … Oct 11, 2018
benchmarking Merge remote-tracking branch 'origin/master' into fix_pep8_errors Oct 8, 2018
bot Merge remote-tracking branch 'origin/master' into fix_pep8_errors Oct 8, 2018
config Removing delay compress so nagios stops complaining on old events Oct 10, 2018
cron Merge remote-tracking branch 'origin/master' into fix_pep8_errors Oct 8, 2018
docker Merge pull request #770 from mozilla/meteor-1.7-update Oct 15, 2018
docs Merge pull request #757 from mozilla/documentation_update Oct 16, 2018
examples Merge remote-tracking branch 'origin/master' into fix_pep8_errors Oct 8, 2018
lib Merge pull request #770 from mozilla/meteor-1.7-update Oct 15, 2018
loginput Fixup inline comments Oct 5, 2018
meteor add bcrypt Oct 15, 2018
mq Add domainname to cloudtrail mapping plugin Oct 11, 2018
rest Merge remote-tracking branch 'origin/master' into fix_pep8_errors Oct 8, 2018
static Remove heatmap html page Jun 15, 2017
systemdfiles Naming Convention and Logging Changes. Oct 4, 2017
tests Make events work for single or multiple events, this alert will work … Oct 11, 2018
.flake8 Merge remote-tracking branch 'origin/master' into fix_pep8_errors Oct 8, 2018
.gitignore update ignore Oct 1, 2018
.travis.yml Add flake8 checks to travisci Oct 5, 2018
CONTRIBUTING.md Modifying urls to point to mozilla from jeffbryner, slight readabilit… Jun 15, 2017
LICENSE Updated license file to conform with MPL Feb 25, 2014
Makefile Mirror andrews docker changes from master...andrewkrug:docker_mainten… Oct 1, 2018
README.md Update readme to remove references to banhammer Oct 4, 2018
requirements.txt Remove pyopenssl from requirements file Oct 10, 2018

README.md

Build Status Documentation Status

MozDef: The Mozilla Defense Platform

Why?

The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

The Mozilla Defense Platform (MozDef) seeks to automate the security incident handling process and facilitate the real-time activities of incident handlers.

Goals:

  • Provide a platform for use by defenders to rapidly discover and respond to security incidents.
  • Automate interfaces to other systems like bunker, cymon, mig
  • Provide metrics for security events and incidents
  • Facilitate real-time collaboration amongst incident handlers
  • Facilitate repeatable, predictable processes for incident handling
  • Go beyond traditional SIEM systems in automating incident handling, information sharing, workflow, metrics and response automation

Status:

MozDef is in production at Mozilla where we are using it to process over 300 million events per day.

DOCS:

http://mozdef.readthedocs.org/en/latest/